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REMARKS 

Examiner rejected claims 1-21 under 35 U.S.C, §103 as being unpatentable over Figs. 1 
and 2 of Applicant's admitted prior art (AAPA) and in view of U.S. Pat, Appl. Pub. Nos, 
20080043686 (Sperti et al.) and 20050213553 (Wang). 

With regard to claims 1 and 2, Examiner said that the AAPA discloses a Togue access 
point and transmit channel preprocessor. It does not. The AAPA only discloses a rogue access 
point preprocessor and not a preprocessor concerning transmit channel as does Applicant, 
Applicant's RogueAPTransmitChannel preprocessor detects a channel on which a received 
packet is transmitted. The AAPA does not do this. Therefore, the AAPA does not disclose 
Applicant's RogueAPTransmitChannel preprocessor and, therefore, does not disclose 
1 Applicant's clEliiii 1 or claim 2. 

Examiner said that Sperti et al, in paras, 74 and 128, and Wang, in para, 35, disclose 
Applicant's preprocessors as follows: RogueClient, BridgedNetwork, RogueClientValidAP s 
ValidClientRogueAP, AdhocNetwork, WrongChannel/cloakingViolatioa, EncryptionViolatioa, 
andNuUSSlDViolation. 

Examiner citation to Sperti et al. in paragraph 128 lists a configuration list of valid APs, 
clients, and channels. None of these disclose Applicant's preprocessors. 

Examiner's citation to Sperti et al. in paragraph 128 also mentions that "an alert is 
generated when information obtained from a packet does not match the information in the 
configuration file." Such a citation is abroad description that discloses the general operation of 
an Intrusion Detection System such as SNORT, which Applicant admitted is prior art. Applicant 
did not claim to have invented the general operation of an IDS. Instead, Applicant claimed to 
have improved an IDS by including preprocessors that previously did not exist. Examiner's 
citation does not disclose the new preprocessors that Applicant included in Applicant's patent 
application, 
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Applicant's RogueClient preprocessor detects a rogue client. Nowhere in Examiner's 
citations is a preprocessor disclosed to detect a rogue client* Therefore, neither Sperti et al, nor 
Wang disclose Applicant's RogueClient preprocessor and, therefore, do not disclose Applicant's 
claim 1 or claim 2. 

Applicant's BridgedNetwork preprocessor detects a wireless distribution system (or 
bridged network). Nowhere in Examiner's citations is a preprocessor disclosed to detect a 
wireless distribution system (or bridged network). Therefore, neither Sperti et aL nor Wang 
disclose Applicant's BridgedNetwork preprocessor and, therefore, do not disclose Applicant's 
claim 1 or claim % 

Applicant's RogueClientValidAP preprocessor detects an unauthorized client attempting 
to connect to a valid access point (AP). Nowhere in Examiner's citations is a preprocessor 
disclosed to detect an unauthorized client attempting to connect to a valid AP> Therefore, neither 
Sperti et al, npr Wang disclose Applicant's RogueClientValidAP preprocessor and, therefore, do 
not disclose Applicant's claim 1 or claim 2. 

^f^licanf s VaKdClienlRogueAP preprocessor detects an authorized client attempting .to r i 
connect to a rogue AP. Nowhere in Examiner's citations is a preprocessor disclosed to detect an 
authorized client attempting to connect to a rogue AP, Therefore, neither Sperti et al. nor Wang 
disclose Applicant's ValidClientRogueAP preprocessor and, therefore, do not disclose 
Applicant's claim 1 or claim 2. 

Applicant's AdhocNetwork preprocessor detects beacons for an ad-hoc network, two 
devices in an ad-hoc network, and an authorized client in ad-hoc mode with a rogue client 
Nowhere in Examiner's citations is a preprocessor disclosed to detect beacons for an ad-hoc 
network, two devices in an ad-hoc network, and an authorized client in ad-hoc mode with a rogue 
client Examiner's citation to Sperti et al. in paragraph 74 also mentions "RF Jamming using ad- 
hoc networks." Using an ad-hoc network does not disclose Applicant's AdHocNetwork 
preprocessor, because using an ad-hoc network does not disclose detecting beacons for an ad-hoc 
network, two devices in an ad-hoc network, and an authorized client in ad-hoc mode with a rogue 
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client as does Applicant's AdHocNetwork preprocessor. Therefore, Examiner's citations do not 
disclose Applicant's AdHocNetwork preprocessor. Therefore, neither Sperti et al. nor Wang 
disclose Applicant's AdHocNetwork preprocessor and, therefore, do not disclose Applicant's 
claim 1 or claim 2. 

Applicant's WrongChannel preprocessor detects a device operating on an unauthorized 
channel Nowhere in Examiner's citations is a preprocessor disclosed to detect a device operating 
on an unauthorized channel. Therefore, neither Sperti et al. nor Wang disclose Applicant's 
WrongChannel preprocessor and, therefore, do not disclose Applicant's claim 1 or claim 2. 

Applicant's CloakingViolation preprocessor detects when an SSID is not NULL when it 
should be NULL. Nowhere in Examiner's citations is a preprocessor disclosed to detect when an 
SSID is riot NULL when ttsho 5 ' -1 

AppHcant'sCloaMngW^ 4f - H 

or claims ^" : .< ; ■-' # .*"•'.• \ \: 1 - : \ • 

Applicant's EncryptionViolation preprocessor detects when a device is operating counter ; ; I 

; - to an! encryption policy (fre^not using encryption when the policy requires encryption arid using ^ ^ i 
encryption when the policy req^es no encryption). N^ • ^ 

preprocessor disclosed to detect when a device is operating counter to an encryption policy. 
Examiner's citation to Sperti et al. in paragraph 128 also mentions "authentication and 
encryption method." Examiner failed to put the citation in proper context The actual citation is 
to "encryption and authentication method used." So, examiner 9 s citation is to using an encryption 
method. Using an encryption method is not the same as detecting if a device is violating an 
! encryption policy as does Applicant's EncryptionViolation preprocessor. Therefore, Examiner's 

citation does not disclose Applicant's EncryptionViolation preprocessor. 
Therefore, neither Sperti et al. nor Wang disclose Applicant's EncryptionViolation preprocessor 
and, therefore, do not disclose Applicant's claim 1 or claim 2, 
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Applicant's NullSSIDViolation preprocessor detects when a device attempts to associate 
with a client that sent a NULL SSDD. Nowhere in Examiner's citations is a preprocessor 
disclosed to detect when a device attempts to associate with a client that sent a NULL SSDD. 
Examiner said that Wang, in paragraph 35, discloses detecting attacks related to cloaking 
violations and NULL SSID. Examiner appears to quote Wang as disclosing "detecting attacks 
comprising a NULL/weak/default SSID probe request sent to an AP in an association or re- 
association request in an attempt to violate the cloaking policy of "cloaking or defaulting" the 
SSID of an AP." If this was intended to be a quote, it was mistakenly quoted, because the citation 
neven discloses the use of a NULL SSID. Instead, an SSID is checked to determine if it is weak 
or is a default SSID. Neither a weak nor a default SSID is a NULL SSID. Per the two 
attachment documents from Abdut.com, a default SSID is a defined SSID, set by the 
manufacturer of the device. A weak SSID implies mat it is an SSID that is easily determined; A' 
NULL SSID is no SSID, which is neither a defined SSID nor m easily determined SSID; &■ . 
addition, Examiner's citation never mentions NULL. The Examiner inserted NULL himself, ' ;; ' ; ^v 
y ExaarinCT appears to have improperly used Applicant's application as the motivation "to toeSt^atV 

NULL into a citation that did hot include NULL. Examiner committed error by doing so! 1 
Furthermore, Examiner associates "defaulting" with "cloaking". "Cloaking is the use of a NULL 
SSID, whereas "defaulting" is the setting of an SSID to a default value, "defaulting" is not 
equivalent to "cloaking." Therefore, Examiner committed error by associating the terms. 
Therefore, neither Sperti et al. nor Wang disclose Applicant's NULLS SID Violation preprocessor 
and, therefore, do not disclose Applicant's claim 1 or claim 2. 

Examiner said that it would be obvious to one of ordinary skill to modify the teachings of 
the AAPA to include preprocessors for detecting attacks taught by Sperti and Wang for the 
purpose of increased security by having a system that can detect as many attacks as possible. 
Examiner admits that Sperti et al. and Wang was not cited for disclosing Applicant' s 
preprocessors but for disclosing attacks. An attack is not a preprocessor, because there may be 
many different solutions to an attack. A preprocessor is a specific solution to an attack. 
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Therefore, an attack cannot and does not disclose the specific preprocessors disclosed by 
Applicant. Sperti et al. and Wang do not disclose Applicant's preprocessors and, therefore, do 
not disclose Applicant's claim 1 or claim 2. 

With regard to claims 3 and 13, Examiner said that the combination of the AAPA, Sperti 
et al. and Wang disclose claim 2. For the reasons given above, the combination of the AAPA, 
Sperti et al. and Wang do not disclose claim 2, However, it appears that Examiner meant to say 
claim 3. So, Applicant responds below assuming that Examiner meant claim 3. 

Examiner appears to have meant to say that the AAPA, Sperti in paragraphs 73-81, 105- 
106, and 130-166 disclose Applicant's claims 3 and 13. Examiner's citation to the AAPA is to a 
description of the SNORT intrusion detection system. SNORT does not include a 
RogueAPTransmitGhanhei preprocessor of Applicant's invention and does not disclose any of 
the steps of claims 3 and 13. Examiner' s citation to Sperti et aL is to a description of a detection 
\ module device, a configuration module device, and a list of attacks, including a DEAUTH attack, 
\ • \^l3^,m^^/jsmB^n^ Denial of Service, man in the middle, fake access point, WEP 

craeldng, inj^tiOT two examples Examiner cited ■'; 

. .are. to attacks that Applicant does^not claim m claims 3 and 13. In addition, claims 3 and 13 
includes all of the limitations of claim 2 and claims 2-3, respectively, which, for the reasons 
given above, Sperti does not disclose. Applicant's claims 3 and 13 are methods of performing 
Applicant's rogue access point and transmit channel preprocessor. Since the combination of the 
AAPA and Sperti et al. does not include all of the steps of claims 3 and 13, the combination of 
the AAPA and Sperti et al. docs not disclose claims 3 and 13. 

The first step of claims 3 and 13 is determining a frame type of the packet. Nowhere in 
Examiner's citations is such a step disclosed. 

The second step of claims 3 and 13 is determining if the frame type contains a basic 
service set identifier (BSSID) or is an acknowledgement message (ACK). Nowhere in 
Examiner's citations is such a step disclosed. 
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The third step of claims 3 and 13 is if the frame does not contain a BSSID and is not an 
ACK then setting global variable Transmit_Channel equal to zero and returning to step (h) in 
claim 2. Nowhere in Examiner's citations is such a step disclosed. 

The fourth step of claims 3 and 1 3 is if the frame contains a BSSID or is an ACK then 
determining if the packet is a beacon frame or a probe response. Nowhere in Examiner's citations 
is such a step disclosed. 

The fifth step of claims 3 and 13 is if either frame type is identified then identifying the 
BSSID and the channel in its header. Nowhere in Examiner's citations is such a step disclosed. 

The sixth step of claims 3 and 13 is determining if the BSSID is in a rogue AP list. 
Nowhere in Examiner's citations is such a step disclosed. 

The seventh step of claims 3 and 13 is if the BSSID is not in the rogue AP list then 
detennining if the BSSID is on a valid AP list Nowhere in Examiner's citations is such a step 

■■■ ; diSClOSed' : :- ; /;\-.; : . -. r : V .:. • :; - 

-The.ei^mstep-efclaims 3 and-13- js ifme. BSSID is not on the valid AF list then adding-':; 
. the BSSID and its channel to the rogue AP list, setting global, variable Transmit. Channel equal- 
: to the BSSID channel, and returning to step (h) in claim 2. Nowhere in Examiner* s citations is ? 
such a step disclosed. 

The ninth step of claims 3 and 13 is if the BSSID is in the rogue AP list or the BSSID is 
not in the rogue AP list but is in the valid AP list then updating the channel information in the 
corresponding rogue and valid AP list entry, setting global variable Transmit_Channel equal to 
the BSSID channel, and returning to step (h) in claim 2. Nowhere in Examiner's citations is such 
a step disclosed. 

The tenth step of claims 3 and 13 is if the frame is neither a beacon frame nor a probe 
response then finding the BSSID in the header. Nowhere in Examiner's citations is such a step 
disclosed. 

The eleventh step of claims 3 and 13 is determining if the BSSID or destination address is 
in a rogue AP list. Nowhere in Examiner's citations is such a step disclosed. 
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The twelfth step of claims 3 and 13 is if the BSSID or the destination address are in the 
rogue AP list then determining its channel in the rogue AP list, setting global variable 
Transmit_Channel equal to the BSSID channel, and returning to step (h) in claim 2. Nowhere in 
Examiner' s citations is such a step disclosed. 

The thirteenth step of claims 3 and 13 is if the BSSID and the destination address are not 
in the rogue AP list then determining if the BSSID or destination address are on the valid AP list 
Nowhere in Examiner's citations is such a step disclosed. 

The fourteenth step of claims 3 and 13 is if the BSSID and the destination address are on 
the valid AP list then determining the BSSID channel in the valid AP list, setting the global 
variable Transmit_Channel equal to the BSSID channel, and returning to step (h) in claim 2. 
Nowhere m Exam^ 

•r ,:/ \$hz fifteenth step .of claims 3 and 13 is if the BSSID and the destuiation address are not ]y 
on the valid AP list then adding the BSSID to the rogue AP list with channel equal to zero, ; 
setting the global v^iable Tiansmit^Ghannel equal to zero, and returning to step (h) in claim 2. ; 
... v:* /\ NQW v. l^ : :- m ;$& 

Examiner said that the AAP A, Sperti in paragraphs 73-81 j 105*106, and 130-166, and 
Wang disclose Applicant's claim 4. Examiner did not cite anything specific in the AAPA or 
Wang, but only cited specifics ftom Sperti et al. Examiner's citation to Sperti et al. is to a 
description of a detection module device, a configuration module device, and a list of attacks, 
including a DEAUTH attack, a LEAP attack, RF jamming, Denial of Service, man in the middle, 
fake access point, WEP cracking, injection of spurious traffic, and NETSTUMBLER, The two 
examples Examiner cited are to attacks that Applicant does not claim in claim 4. In addition, 
claim 4 includes all of the limitations of claim 2 which, for the reasons given above, Sperti does 
not disclose. Applicant's claim 4 is a method of preprocessing a packet using a rogue client 
preprocessor as follows. 

The first step of claim 4 is determining a frame type of the packet. Nowhere in 
Examiner' s citations is such a step disclosed. 
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The second step of claim 4 is determining if the frame type contains a source address. 
Nowhere in Examiner's citations is such a step disclosed. 

The th ird step of claim 4 is if the frame type does not contain a source address then 
returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The fourth step of claim 4 is if the frame contains a source address then finding the source 
address in its header. Nowhere in Examiner's citations is such a step disclosed 

The fifth step of claim 4 is determining if the packet is from an access point. Nowhere in 
Examiner's citations is such a step disclosed. 

The sixth step of claim 4 is if the packet is from an access point then returning to step (h) 
in claim 2. Nowhere in Examiner's citations is such a step disclosed. 

The seventh step of claim 4 is determining if the so ^ 
Nowhere in Examiner's cite^ ;vfr 
lie eighth step 

determiningif the source address is on a v^d client list Nowhere in Examiner's citations is such 
:^v/; f:.ai step disclosed- . =• ?; , ' •.: : ; • ■ ■•. \- 

; . The nmth step of claim^^ on the valid client list then returning 

to. step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The tenth step of claim 4 is if the packet is not on the valid client list then adding the 
source address to the rogue client list, generating an alert message to indicate that a rogue client 
has been detected, and returning to step (h) in claim % Nowhere in Examiner's citations is such a 
step disclosed. 

The eleventh step of claim 4 is if the source address is on the rogue client list then 
determining if a user-defined time period has expired. Nowhere in Examiner's citations is such a 
step disclosed. 

The twelfth step of claim 4 is if the user-definable time-period has not expired then 
returning to step (h) in claim 2. Nowhere in Examiner's citations is such a step disclosed. 
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The thirteenth step of claim 4 is if the user-definable time-period has expired then adding 
the source address to the rogue client list, generating an alert message to indicate that a rogue 
client had been detected, and returning to step (h) in claim 2. Nowhere in Examiner's citations is 
such a step disclosed. 

Examiner said that the AAPA, Wang, and Sperti in paragraphs 73-81, 105-106, and 130- 
166 disclose Applicant's claims 5 and 14. Examiner did not cite anything specific in the AAPA 
or Wang, but only cited specifics from Sperti et al. Examiner's citation to Sperti et al. is to a 
description of a detection module device, a configuration module device, and a list of attacks, 
including a DEAUTH attack, a LEAP attack, RF jamming, Denial of Service, man in the middle, 
fake access point, WEP cracking, injection of spurious traffic, and NETSTUMBLER. The two 
• vexamples : "Exammercited-are to attacks 'that Applicant does not claim in eitherclaim 5 or cMbcu ~fr\~ • r.~. 3 
14; hi addition, claim 14 includes all of the limitations of claims 3 and 13 which, for the reasons pu^^^p 
given above, Sperti does not disclose. Applicant's claims 5 and 14 are methods of preprocessing S 
. - or ^ : c^ ' ^ 

.:■ The first step of claims 5 and 14 is finding a frametype of the packet Nowhere in . • * ; r 
Examiner's citations is such & step disclosed. ; " - 

The second step of claims 5 and 14 is determining if the frame contains a source address. 
Nowhere in Examiner's citations is such a step disclosed. 

The third step of claims 5 and 14 is if the frame type does not contain a source address 
then returning to step (h) in claim 2. Nowhere in Examiner's citations is such a step disclosed. 

The fourth step of claims S and 14 is if the frame contains a source address then 
detOTnining'if the frame is a data frame. Nowhere in Examiner's citations is such a step 
disclosed. 

The fifth step of claims 5 and 14 is if the frame is not a data frame then returning to step 
(h) in claim 2. Nowhere in Examiner's citations is such a step disclosed. 

The sixth step of claims 5 and 14 is if the frame is a data frame then determining if to_ds 
and from_ds are each set to one, Nowhere in Examiner's citation is such a step disclosed. 
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The seventh step of claims S and 14 is if to_ds and from_ds are not both set to one then 
returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The eighth step of claims 5 and 14 is if tojis and from ds are each set to one then 
determining if the source and destination addresses are on an alert list. Nowhere in Examiner's 
citation is such a step disclosed. 

The ninth step of claims 5 and 14 is if the source and destination addresses are on the 
alert list then toermining if a user-definable time-period has expired. Nowhere in Examiner's 
citation is such a step disclosed. 

The tenth step of claims 5 and 14 is if the user-definable time-period has not expired then 
returning to step flri in cMm 7 Nowhere in Examiner's citation is such a step disclosed. 

The el&vehth step of claims $ and 14 & if either the user-definable time-period has : 
expired or if the source and destination addresses are not on the alert list then adding the soured 
and destination addresses to the alert list generating an alert that indicates that a bridged Network 
has bfeen detected* and returning to step (b) in claim 2. Nowhere in Examiner's citation is^such e 
?■ .':v.! 5 - : - step disclosed,; p; f . y^z '-^LwL- - • •'• r. • • ; ^j: * •• • ' : :; .'■ *. '-'^ P< ^ 

Examiner said that the AAPA, Wang s and Sperti in paragraphs 73-81, 105-106, and 130- 
166 disclose Applicant's claims 6 and 1 5, Examiner did not cite anything specific in the AAPA 
or Wang 8 but only cited specifics from Sperti et al. Examiner's citation to Sperti et al. is to a 
description of a detection module device 9 si configuration module device, and a list of attacks, 
including a DEAUTH attack, a LEAP attack, RF jamming, Denial of Service, man in the middle, 
fake access point, WEP cracking, injection of spurious traffic, and NETSTUMBLER, The two 
examples Examiner cited are to attacks that Applicant does not claim in either claim 6 or claim 
15. In addition, claim 15 includes all of the limitations of claims 3 and 13-14 which, for the 
reasons given above, Sperti does not disclose. Applicant's claims 6 and 15 are methods of 
preprocessing a packet using a rogue client valid access point preprocessor as follows. 

The first step of claims 6 and 15 is finding a frame type of the packet. Nowhere in 
Examiner's citation is such a step disclosed. 

11 

PAGE 12/29* RCVD AT 5111/2011 3:21:10 PM [Eastern Daylight Time] * SVR:W-PTOFAX-002/27 * DNIS:2738300 * CS1D: * DURATION (mm-ss):08-50 



MAY. 11.2011 3:51PM 



NO. 009 P. 13 



The second step of claims 6 and 15 is determining if the frame contains a source address. 
Nowhere in Examiner's citation is such a step disclosed. 

The third step of claims 6 and 15 is if the frame does not contain a source address then 
returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The fourth step of claims 6 and 15 is if the frame contains a source address then 
determiniog if the frame is an authentication request Nowheie in Examiner's citation is such a 
step disclosed. 

The fifth step of claims 6 and 15 is if the frame is an authentication request then 
determining if the source address is on a rogue client list. Nowhere in Examiner's citation is such 
a step disclosed. * 
w^v; :;:-:( : - ^ ■ . The-fcixth sUg*.o£ clsims.tf and.\l£-is: ifthe frame- is' not sn- authentication request then ' : *-" s 
■ a % tetu^ 2, Nowh^e in Exam^^ is such a step disclosed, I Vv.v$£ 

jV-^vv-:^ pf claims 6 and 15 js if 1jie source address is not on the rogue - client list /: 

, i o -.j : - \. tfeto^ client list. Nowhere in Examiner's dtatioh ? v 

. -r; ; ;~is such a step disclosed "-^ .. :■ ■« " • iS 

:>\?A. „ Ihe;dghlii'Step- 6f claims 6 and 15 v isif thfcsource address is on the vaHdclieniHSt then ■ 

returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The ninth step of claims 6 and 15 is if the source address is either on the rogue client list 
or not on the rogue client list or the valid client list then determining if the destination access 
point address is valid. Nowhere in Examiner's citation is such a step disclosed. 

The tenth step of claims 6 and 15 is if the destination access point address is not valid 
then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed, 
The eleventh step of claims 6 and 15 is if the destination access point address is valid 
then determining if the source address is on a bad authentication request list. Nowhere in 
Examiner's citation is such a step disclosed. 
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The twelfth step of claims 6 and 15 is if the source address is on the bad authentication 
request list then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step 
disclosed. 

The thirteenth step of claims 6 and 15 is if the source address is not on the bad 
authentication request list then adding the source address to the bad authentication request list, 
generating an alert to indicate that an unauthorized client is attempting to connect to a valid 
access point, and returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step 
disclosed. 

Examiner said that the AAPA, Wang, and Sperti in paragraphs 73-81 , 105-106, and 130- 
166 disclose Applicant's claims 7 and 1 6. Examiner did not cite anything specific in the AAPA 
v or Wang,, but only cited specifics from Sperti et aL ^xaminer!s citation to Sperti et alas to a A > - ^ ;^ 
.<tesqiptipno 

>v f .. : . . .including a DE^T^^apk, a LEAP attach RF jatpping, Denial qf Service, man in the middle ; ;'X £ 

examples Examiner cited are to attaci:s : that Applicant does not claim in eitherclaim 7 : attitiifi-i"-: 
. s . : . 16, .additipn, claim 16 inpludes all of the limitations of claims 3, and. 13-15 whicM or tfcte^- >;v \^<4 

reasons given above, Sperti does not disclose. Applicant's claims 7 and 16 are methods of : 
preprocessing a packet using valid client rogue access point preprocessor 
as follows. 

The first step of claims 7 and 16 is detenniniog a frame type of the packet. Nowhere in 
Examiner's citation is such a step disclosed. 

The second step of claims 7 and 16 is determining if the frame contains a source address. 
Nowhere in Examiner's citation is such a step disclosed. 

The third step of claims 7 and 16 is if the frame does not contain a source address then 
returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 
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The fourth step of claims 7 and 16 is if the frame contains a source address then 
determining if the frame is an authentication request. Nowhere in Examiner's citation is such a 
step disclosed 

The fifth step of claims 7 and 16 is if the frame is not an authentication request then 
returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The sixth step of claims 7 and 16 is if the frame is an authentication request then 
determining if the source address is on a rogue client list. Nowhere in Examiner's citation is such 
a step disclosed. 

The seventh step of claims 7 and 16 is if the source address is on a rogue client address 
then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The eighth step of claims 7 and 1 6 is if the source address is not on a rogue client address 

, ..thendet^ 

• :vk ; n k/ , 

Ihen retim^ Nowhere, in Examiner's citation. is such, a step disclosed, J 

m : The tenth-step of claims 7 and 16 is if the source.addressison the- valid client list then 

determining if the destination address is rogue. Nowhere in Examiner's citation is such a step 
disclosed. 

The eleventh step of claims 7 and 16 is if the destination address is not rogue then 
returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The twelfth step of claims 7 and 16 is if the destination address is rogue then determining 
if the source address is on a had authentication request list. Nowhere in Examiner's citation is 
such a step disclosed. 

The thirteenth step of claims 7 and 16 is if the source address is on a bad authentication 
request list then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a* step 
disclosed. 
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The fourteenth step of claims 7 and 16 is if the source address is not on the bad 
authentication request list then adding the source address to the bad authentication request list, 
generating an alert to indicate that an authorized client is attempting to connect to a rogue access 
point, and returning to step (h) in claim 2, Nowhere in Examiner's citation is such a step 
disclosed. 

Examiner said that the AAPA S Wang, and Sperti in paragraphs 73-81, 105-106, and 130- 
166 disclose Applicant's claims 8 and 17. Examiner did not cite anything specific in 1he AAPA 
or Wang, but only cited specifics from Sperti et al. Examiner's citation to Sperti et al. is to a 
description of a detection module device, a configuration module device, and a list of attacks, 
including a DEAUTH attack, a LEAP attack, RF jamming, Denial of Service, man in the middle, 
fijke access point, WEP cracking* injection of spurious traffic v :and-NETSTUMBLEItllie two hf> ' 'k 
: - - examples Examiner cited are to attacks that: Applicant does not claim in either claim 8 or claim • - r ^ 5»ft 
17. In addition, claim 17 includes all of the limitations of claims 3 and 13-16 which, for the e \ H 5 : ; ^ 
^4 / , ;:v: ;: ^reasons given show; Sp^l does ^ 8 andlfcjwiipfc^ 

n't y ; ; : ; The first step of c^^^ I c 

Examiner's citation is such a step disclosed. 

The second step of claims 8 and 17 is detennining if the frame contains a source address. 
Nowhere in Examiner's citation is such a step disclosed. 

The third step of claims 8 and 17 is if the frame does not contain a source address then 
returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The fourth step of claims 8 and 17 is if the frame contains a source address then 
determining if the frame is a beacon or a probe response. Nowhere in Examiner's citation is such 
a step disclosed. 

The fifth step of claims 8 and 17 is if the frame is a beacon or probe response then 
determining if ESS is equal to zero and IBSS is equal to one. Nowhere in Examiner's citation is 
such a step disclosed. 

15 

PAGE 16/29* RCVD AT 5/11/2011 3:21:10 PM [Eastern Daylight Time] 1 SVR:W«PTOFAX«002/27 ' DNIS:2738300 * CSID: * DURATION (mm-ss):08-50 



MAY. 11.2011 3:52PM 



NO. 009 P. 17 



The sixth step of claims 8 and 17 is if ESS is not equal to zero or IBSS is not equal to one 
then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The seventh step of claims 8 and 1 7 is if ESS is equal to zero and IBSS is equal to one 
then adding the source address to the ad-hoc beacon alert list, generating an ad-hoc beacon 
detected alert, and returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step 
disclosed. 

The eighth step of claims 8 and 17 is if the frame is neither a beacon nor a probe request 
then determining if the frame is a data frame. Nowhere in Examiner's citation is such a step 
disclosed. 

The ninth step of claims 8 and 1 7 is if the frame is not a data frame then returning to step 

(h>iric]^ «A 

The tenth step of daims 8 and ^ 
and frOm_ds are each set to zero. Nowhere in Examiner's citation is such a step disclosed! 

Tie eleventh step of claims 8 and 17 is if tojds and i fronij3s are notbbm setto zero then 
"returning to step (h) in claim 2. Nowhere in Exainmer's&ta&jn is such a step disclosed. : &A - 

: :• Tie twelfth step of claims * and-17 Is if tojis Wfrbm Jis tie each set to zero then : 
determining if the source and destination addresses are on an active ad-hoc network alert list. 
Nowhere in Examiner's citation is such a step disclosed. 

The thirteenth step of claims 8 and 17 is if the source and destination addresses are on the 
active ad-hoc network alert list then returning to step (h) in claim 2. Nowhere in Examiner's 
citation is such a step disclosed. 

The fourteenth step of claims 8 and 17 is if the source and destination addresses are not 
on the active ad-hoc network alert list then adding the source and destination addresses to the 
alert list and generating an active ad-hoc network detected alert. Nowhere in Examiner's citation 
is such a step disclosed. 

The fifteenth step of claims 8 and 17 is detennining if the source address is on a valid 
client list. Nowhere in Examiner's citation is such a step disclosed. 
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The sixteenth step of claims 8 and 17 is if the source address is not on the valid client list 
then determining if the destination address is on the valid client list. Nowhere in Examiner's 
citation is such a step disclosed. 

The seventeenth step of claims 8 and 17 is if the destination address is not on the valid 
client list then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step 
disclosed. 

The eighteenth step of claims 8 and 17 is if the destination address is on the valid client 
list then generating an authorized client in ad-hoc conversation with rogue client alert, and 
returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The nineteenth step of claims 8 and 17 is if the source address is on the valid client list 

, .^.deteam^^%di»teioa address is onthe-vatid cHent-lisfc-Nowbess ittExaminra»* x 

. _ . , The. twentieth step of claims 8. and.17 is if ifae destination address is not on the -valid / 
Hs^fh^^en^ftfng.an authorized ohent in ad-hou conversation with rogue client ria&'tad' 
• retunn^gtos^ citationig such a step- disclosed," -v^v; 1 ^) 

TJte.^wenty-rfiret step of claims 8 and 17 is if the destination addressjs on the valid client 1 : 
list then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

Examiner said that the AAPA, Wang, and Sperti in paragraphs 73-81, 105-106, and 130- 
166 disclose Applicant's claims 9 and 18. Examiner did not cite anything specific in the AAPA 
or Wang, but only cited specifics from Sperti et al. Examiner's citation to Sperti et al. is to a 
description of a detection module device, a configuration module device, and a list of attacks, 
including a DEAUTH attack, a LEAP attack, RF jamming, Denial of Service, man in the middle, 
fake access point, WEP cracking, injection of spurious traffic, and NETSTUMBLER. The two 
examples Examiner cited are to attacks that Applicant does not claim in cither claim 9 or claim 
18. In addition, claim 18 includes all of the limitations of claims 3 and 13-17 which, for the 
reasons given above, Sperti does not disclose. Applicant's claims 9 and 18 are methods of 
preprocessing a packet using a wrong channel preprocessor as follows. 
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The first step of claims 9 and 1 8 is determining a frame type of the packet. Nowhere in 
Examiner's citation is such a step disclosed. 

The first step of claims 9 and 18 is determining if the frame contains a source address. 
Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 9 and 18 is if the frame does not contain a source address then 
returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 9 and 18 is if the frame contains a source address then 
determining the source address in its header. Nowhere in Examiner's citation is such a step 
disclosed. 

The first step of claims 9 and 1 8 is determining if the source address is in a valid client 
::. ■.. . !: KsttNowfc^ m^ - fc v;-- ; 

The first step of claims 9 and 18 is if the source address is riot in the valid client list then^ 
r- \ determinmg if the source address is ina valid access point list Nowhere in Examiner's citation is 

^ v^\- ^- : ;-v;»!s^;ia;step disclosed;--;;; -V./* • v^v.-^: 

; ^ ; v: ^ - .The first Ktep^f cMmsS aad! iSis if the so^ adc%ss is not in the valid access ^inf ; * 
'\f> : r : ^ Examiner's citation is such a step disclosed: r 

" The first step ofclaims 9 and 18 is iflhe source address is in the valid client list or riot in 
the valid client list but in the valid access point list then determining and recording the 
designated operating channel. Nowhere in Examiner's citation is such a step disclosed. 

The first step ofclaims 9 and 18 is detennining if the source address is in a wrong 
channel alert list. Nowhere in Examiner's citation is such a step disclosed. 

The first step ofclaims 9 and 18 is if the source address is in the wrong channel alert list 
then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The first step ofclaims 9 and 18 is if the source address is not in the wrong channel alert 
list then determining if a transmit channel on which the packet was transmitted is a designated 
operating channel for the source address. Nowhere in Examiner's citation is such a step 
disclosed, 
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The first step of claims 9 and 1 8 is if the transmit channel is equal to the designated 
operating channel then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a 
step disclosed, 

The first step of claims 9 and 1 8 is if the transmit channel is not equal to the designated 
operating channel then adding the source address to the wrong channel alert list, generating a 
device operating on the wrong channel alert, and returning to step (h) in claim 2. Nowhere in 
Examiner's citation is such a step disclosed. 

Examiner said that the AAPA, Wang, and Sperti in paragraphs 73-81 , 105-106, and 130- 
166 disclose Applicant's claims 10 and 19. Examiner did not cite anything specific in the AAPA 
or Wang, but only cited specifics from Sperti et al. Examiner's citation to Sperti et al is to a 
j; description of a detection module device, a configuration module d^ a list of attacks, iov 
V- iSdudBiig * DE^tTiH: attai^ a LEAP attack, RF jamming, DenM of Service, man intbetnicUHftr 
: ^ 

examples Examiner cited are to attacks that Applicant^ 

reasons given abpye^ Sp^ dojss not disclose; Applicant's claims 10 and 19 are methods of ; 
preprocessing a packet using a cloaking violation preprocessor as follows. 

The first step of claims 1 0 and 1 9 is determining a frame type of the packet Nowhere in 
Examiner's citation is such a step disclosed. 

The first step of claims 10 and 19 is determining if the frame is a beacon. Nowhere in 
Examiner's citation is such a step disclosed. 

The first step of claims 10 and 19 is if the frame is not a beacon then returning to step (h) 
in claim 2, Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 10 and 19 is if the frame is a beacon then determining if 
cloaking_required is equal to a one. Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 10 and 19 is if cloaking_required is not equal to a one then 
returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed, 
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The first step of claims 10 and 19 is if cloaking^required is equal to a one then 
determining if SSID is null. Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 10 and 19 is if SSID is null then returning to step (h) in claim 2, 
Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 10 and 19 is if SSID is not null then determining if the source 
address of the packet is on a cloaking policy alert list. Nowhere in Examiner's citation is such a 
step disclosed. 

The first step of claims 10 and 19 is if the source address of the packet is on the cloaking 
policy alert list then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a 
step disclosed. 

■ : : ; : : : : ^v^ftfi^.^^of claims, 10/ and : 19 is if the source address of the packet-is not on the: v A 
cloaldng^^ the cloaking policy alert list, •: i : ;j* 

% generating a: SSH} eioaki^ poUcy violation detected alert, and returning to step (h) in claim 2; 

i';w:^7: 105-106, -arid ;1|3M 

.■I \ 166 displbse Applicant's' claims. 11 and 20. Ekaminer did not cite anything specific in the^AAM; 
or Wang, but only cited specifics from Sperti et al. Examiner's citation to Sperti et al. is to a 
description of a detection module device, a configuration module device, and a list of attacks, 
including a DEAUTH attack, a LEAP attack, RF jamming, Denial of Service, man in the middle, 
fake access point, WEP cracking, injection of spurious traffic, and NETSTUMBLER, The two 
examples Examiner cited are to attacks that Applicant does not claim in either claim 1 1 or claim 
20. In addition, claim 20 includes all of the limitations of claims 3 and 13-19 which, for the 
reasons given above, Sperti does not disclose. Applicant's claims 1 1 and 20 are methods of 
preprocessing a packet using an encryption violation preprocessor as follows. 

The first step of claims 1 1 and 20 is determining a frame type of the packet. Nowhere in 
Examiner's citation is such a step disclosed 
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The first step of claims 1 1 and 20 is determining if the ftame is a probe response or a 
beacon frame. Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 1 1 and 20 is if the frame is neither a probe response nor a beacon 
frame then determining if the frame is a data frame or an authentication frame. Nowhere in 
Examiner's citation is such a step disclosed. 

The first step of claims 1 1 and 20 is if the frame is neither a data frame nor an 
authentication frame then returning to step (h) in claim 2, Nowhere in Examiner's citation is such 
a step disclosed. 

The first step of claims 1 1 and 20 is if the frame is a probe response, beacon frame, data 
frame, or authentication frame then determining if encryption jraquired is set to a one. Nowhere 
: xV: ■ ih;Exam^ *. i ^ * 

- v , %ir The fitst step of claims 11 and 20 is if encryption j*eqti^ is not set to a one then ; yi? ^ 

jetuming to step (h) in ckim 2rNo\Vliere in Examiner V citation is : such a step^ disclosed.; v-t'^-^.:^ 
-;A*. ' k first step of claims 11 and 20 is if enc^tiorrrequired is set to a one and theiframe-.isr. 

. : ^ is a one/Nowhe^^^^ 

; v ; ;: ^ vP3^on i§ su^ • %: ;■ v :-Aw\ 

The first step of claim* 1 1 and 20 is if wep is a one then returning to step (h) in claim 2. 
Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 1 1 and 20 is if wep is not a one then determining if the source 
address of the packet is on an encryption policy alert list Nowhere in Examiner's citation is such 
a step disclosed. 

The first step of claims 1 1 and 20 is if the source address of the packet is on the 
encryption policy alert list then returning to step (h) in claim 2. Nowhere in Examiner's citation 
is such a step disclosed. 

The first step of claims 1 1 and 20 is if the source address of the packet is not on the 
encryption policy alert list then adding the source address to the encryption policy alert list, 
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generating an encryption policy violation detection alert, and returning to step (b) in claim 2. 
Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 1 1 and 20 is if encryption_required is set to a one and the frame is 
a beacon or a probe response frame then determining if a privacy field is set to a one, Nowhere in 
Examiner's citation is such a step disclosed. 

The first step of claims 1 1 and 20 is if the privacy field is set to a one then returning to 
step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 1 1 and 20 is if the privacy field is not set to a one then 
determining if the source address is on the encryption policy alert list Nowhere in Examiner's 
citation is such a step disclosed. 

The first step of claims 1 1 and 20 is if the wo^^^idd^i^eiL^ encryption policy alert 
list then returning ta step (h) in claim 2, Nowhere in Examiner's citation is such a step disclosed. 

: alert list then adding the sourcfcaddress to the encryption policy alert list, generating an 
- vtv;v ^mci^^rt^ and returning to step (h) m claim 2wNowher^ii :v? ^; 

Examiner's citation is such a step disclosed.. ^ : r : -<\ > \ f 

Examiner said that the AAPA, Wang, and Sperti in paragraphs 73-81, 105-1065 and 130- 
166 disclose Applicant's claims 12 and 21. Examiner did not cite anything specific in the AAPA 
or Wang, but only cited specifics from Sperti et ah Examiner's citation to Sperti et al is to a 
description of a detection module device, a configuration module device, and a list of attacks, 
including a DEAUTH attack, a LEAP attack, RF jamming, Denial of Service, man in the middle, 
fake access point, WEP cracking, injection of spurious traffic, and NETSTUMBLER. The two 
examples Examiner cited are to attacks that Applicant does not claim in either claim 12 or claim 
21. In addition, claim 21 includes all of the limitations of claims 3 and 13-20 which, for the 
reasons given above, Sperti does not disclose. Applicant's claims 12 and 21 are methods of 
preprocessing a packet using a null SSID violation preprocessor as follows. 
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The first step of claims 12 and 21 is determining a frame type of the packet. Nowhere in 
Examiner's citation is such a step disclosed. 

The first step of claims 12 and 21 is determining if the frame is a probe request Nowhere 
in Examiner's citation is such a step disclosed. 

The first step of claims 12 and 21 is if the frame is a probe request then determining if 
mill_ssid_assoc is set to a zero. Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 12 and 21, as amended, is if null_ssid_assoc is not set to a zero 
then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 12 and 21 is if null_ssid_assoc is set to a zero then determining if 
SSID is null. Nowhere in Examiner's citation is such a step disclosed. 

;- 4 j 2. Nowhe^ 
r: :i: •:■.,) /,:■>:.- ^ set to mill Aen 

. v: - v v address of the packet is jtaa hip^^t prqte^ 

The first step of claims 12 and 21 is if the source ad&es^ 
probe request-senders list then returning to step (h) in claim 2. Nowhere in Examiner's citation is • 
such a step disclosed 

The first step of claims 12 and 21 is if the source address of the packet is not in the 
broadcast probe request senders list then adding the source address to the broadcast probe request 
senders list and returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step 
disclosed. 

The first step of claims 12 and 21 is if the frame is not a probe request then determining if 
the frame is a probe response. Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 12 and 21 is if the frame is a probe response then determining a 
destination address in its header. Nowhere in Examiner's citation is such a step disclosed. 
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' The first step of claims 12 and 21 is determining if the destination address is in the 
broadcast probe request senders list. Nowhere in Examiner's citation is such a step disclosed 

The first step of claims 12 and 21 is if the destination address is not in the broadcast 
piobe request senders list then returning to step (h) in claim 2. Nowhere in Examiner's citation is 
such a step disclosed. 

The first step of claims 12 and 21 is if the destination address is on the broadcast probe 
request senders list then determining if the source address is on a broadcast probe alert list 
Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 12 and 21 is if the source address is on the broadcast probe alert 
list then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 
?V 1;^ ! • ^ the first step of claims 12 arid 21 is if the soujte^drfessis'n6t«dn-the broadcast probe ^ • •^•.V^'i? 
.a- '^9l^M^i^'^Mng the source address to the broadcast probe alert Eist, generating a NulllSD>*'^% 
: assod^on al^rt- and returning to ste^ (h) in claim 2; Nowhere in Examiner's citation is such 

: J; ;, ' The first step of claims 12 and 21 is if the fiame is nbta probe response to deteraiimn&^:#iH''# 
if the frame is ah assbbiatibri request, No\^ 

The first step of claims 12 and 21 is if the frame is an association request then 
determining if null_ssid_assoc is set to a zero. Nowhere in Examiner's citation is such a step 
disclosed. 

The first step of claims 12 and 21 is if nuU_ssid_assoc is not set to a zero then returning 
to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 12 and 21 is if null_ssidjissoc is set to a zero then determining if 
SSID is set to null. Nowhere in Examiner's citation is such a step disclosed. 

The first step of claims 12 and 21, as amended, is if SSID is not set to null then returning 
to step (h) in claim 2. Nowhere in Examiner's citation is such a step disclosed. 
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The first step of claims 12 and 21 is if SSED is set to null then determining if the source 
address is on a broadcast association request senders list. Nowhere in Examiner's citation is such 
a step disclosed. 

The first step of claims 12 and 21 is if the source address is on the broadcast association 
request senders list then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a 
step disclosed. 

The first step of claims 12 and 21 is if the source address is not on the broadcast 
association request senders list then adding the source address to the broadcast association 
request senders list, and returning to step (h) in claim 2. Nowhere in Examiner's citation is such a 
step disclosed. 

; • > ■ The fihtstep^ : 
'i determining if the frame is^assomtica response. Nowhere in Examiner 8<dtaiion is subk a/y; 

i^Jy^l '-}: step disclosed. )■,:/:-■ : .v- : > <z%i.i'kyri:: -;/:••£. 

• : The first step of claims 12 and21 is if thefiameisnotan^ 

>-y.i? : ..returning'^ is such a step disclosed, -y.^aveg 

: ; v t 

determining a destination address in its header. Nowhere in Examiner's citation is such a step 
disclosed. 

The first step of claims 12 and 21 is determining if the destination address is on the 
broadcast association request senders list Nowhere in Examiner's citation is such a step 
disclosed. 

The first step of claims 12 and 21 is if the destination address is not on the broadcast 
association request senders list then returning to step (h) in claim 2. Nowhere in Examiner's 
citation is such a step disclosed. 

The first step of claims 12 and 21 is if the destination address is on the broadcast 
association request senders list then determining if the source address is on a broadcast 
association alert list. Nowhere in Examiner's citation is such a step disclosed. 
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The first step of claims 12 and 21 is if the source address is on the broadcast association 
alert list then returning to step (h) in claim 2. Nowhere in Examiner's citation is such a step 
disclosed. 

The first step of claims 12 and 21 is if the source address is not on the broadcast 
association alert list then adding the source address to the broadcast association alert list, 
generating a Null SSID association alert, and returning to step (h) in claim 2. Nowhere in 
Examiner's citation is such a step disclosed. 

For the reasons given above, Applicant rebuts Examiner's obviousness rejection of claim 
1-21 , Applicant submits thai the application is in condition for allowance. 

Reconsideration of the application in light of the rebuttal is requested. Allowance of 
claims 1-2 1 is solicited £ : 

Respectfully submitted, 




l : \£me^ic ■ ..\\ * ^i-, ^re? c :;;- ^Robert D. Morelii ' ■ '• 

Registration No. 37,398 

,3 ; j: : .: : • v V,.,:;,,. - . , 1)688-028? • 
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